Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
24-04-2024 04:48
General
-
Target
New DHL Shipment Document Arrival Notice.pdf.exe
-
Size
991KB
-
MD5
189b8ac3c0f8d840f30f4897b2d89773
-
SHA1
e6e6c3bd752cde7cf0677575d9268fc2a2070331
-
SHA256
7fee503438f90d0206012674566587b5ecef1d040935809ae308b12842dc6196
-
SHA512
052b3ccd16b840ff50fecc83229a0e9b432629084ef1a43af02d794debfc95a0aa054840feb3a82631176b08a3fcc8c5542c8052811ba6434e416e339dccbf16
-
SSDEEP
24576:o0QxK82SgCUzIQTTzhp11LP059ncTAG6Ox23:om8lgDIv59nXQ23
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New DHL Shipment Document Arrival Notice.pdf.exe"C:\Users\Admin\AppData\Local\Temp\New DHL Shipment Document Arrival Notice.pdf.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1732 -s 5402⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1732-0-0x0000000000EC0000-0x0000000000F28000-memory.dmpFilesize
416KB
-
memory/1732-1-0x000007FEF5A40000-0x000007FEF642C000-memory.dmpFilesize
9.9MB
-
memory/1732-2-0x000000001B0D0000-0x000000001B150000-memory.dmpFilesize
512KB
-
memory/1732-3-0x000007FEF5A40000-0x000007FEF642C000-memory.dmpFilesize
9.9MB
-
memory/1732-4-0x000000001B0D0000-0x000000001B150000-memory.dmpFilesize
512KB